Commit 6c830753 authored by ale's avatar ale

support relocatable ca roots

parent d9876b86
...@@ -101,12 +101,14 @@ class CA(object): ...@@ -101,12 +101,14 @@ class CA(object):
csr_file = os.path.join(tmpdir, 'ca.csr') csr_file = os.path.join(tmpdir, 'ca.csr')
log.info('creating new RSA CA CSR') log.info('creating new RSA CA CSR')
openssl_wrap.run_with_config( openssl_wrap.run_with_config(
self.files.conf, 'req', '-new', self.basedir, self.files.conf,
'req', '-new',
'-passout', 'pass:%s' % self._getpw(), '-passout', 'pass:%s' % self._getpw(),
'-keyout', self.files.private_key, '-out', csr_file) '-keyout', self.files.private_key, '-out', csr_file)
log.info('self-signing RSA CA certificate') log.info('self-signing RSA CA certificate')
openssl_wrap.run_with_config( openssl_wrap.run_with_config(
self.files.conf, 'ca', '-keyfile', self.files.private_key, self.basedir, self.files.conf,
'ca', '-keyfile', self.files.private_key,
'-key', self._getpw(), '-key', self._getpw(),
'-extensions', 'v3_ca', '-out', self.files.public_key, '-extensions', 'v3_ca', '-out', self.files.public_key,
'-days', self.config.get('days', self.config['default_days']), '-days', self.config.get('days', self.config['default_days']),
...@@ -127,14 +129,16 @@ class CA(object): ...@@ -127,14 +129,16 @@ class CA(object):
def gencrl(self): def gencrl(self):
log.info('generating CRL') log.info('generating CRL')
openssl_wrap.run_with_config( openssl_wrap.run_with_config(
self.files.conf, 'ca', '-gencrl', '-out', self.files.crl, self.basedir, self.files.conf,
'ca', '-gencrl', '-out', self.files.crl,
'-key', self._getpw()) '-key', self._getpw())
os.chmod(self.files.crl, 0644) os.chmod(self.files.crl, 0644)
def revoke(self, cert): def revoke(self, cert):
log.info('revoking certificate %s', cert.name) log.info('revoking certificate %s', cert.name)
openssl_wrap.run_with_config( openssl_wrap.run_with_config(
self.files.conf, 'ca', '-revoke', cert.public_key_file, self.basedir, self.files.conf,
'ca', '-revoke', cert.public_key_file,
'-key', self._getpw()) '-key', self._getpw())
self.gencrl() self.gencrl()
...@@ -162,11 +166,13 @@ class CA(object): ...@@ -162,11 +166,13 @@ class CA(object):
utils.render(conf_file, 'openssl_config', conf) utils.render(conf_file, 'openssl_config', conf)
utils.render(ext_file, 'ext_config', conf) utils.render(ext_file, 'ext_config', conf)
openssl_wrap.run_with_config( openssl_wrap.run_with_config(
conf_file, 'req', '-new', '-keyout', cert.private_key_file, self.basedir, conf_file,
'req', '-new', '-keyout', cert.private_key_file,
'-nodes', '-out', csr_file) '-nodes', '-out', csr_file)
os.chmod(cert.private_key_file, 0600) os.chmod(cert.private_key_file, 0600)
openssl_wrap.run_with_config( openssl_wrap.run_with_config(
conf_file, 'ca', '-days', conf['days'], self.basedir, conf_file,
'ca', '-days', conf['days'],
'-key', self._getpw(), '-key', self._getpw(),
'-policy', 'policy_anything', '-out', cert.public_key_file, '-policy', 'policy_anything', '-out', cert.public_key_file,
'-extfile', ext_file, '-infiles', csr_file) '-extfile', ext_file, '-infiles', csr_file)
......
import logging import logging
import os
import subprocess import subprocess
log = logging.getLogger(__name__) log = logging.getLogger(__name__)
...@@ -8,11 +9,13 @@ class CommandError(Exception): ...@@ -8,11 +9,13 @@ class CommandError(Exception):
pass pass
def run(*args): def run(*args, **env_vars):
cmd = ['openssl'] cmd = ['openssl']
cmd.extend(args) cmd.extend(args)
env = dict(os.environ)
env.update(env_vars)
log.debug('executing "%s"' % ' '.join(cmd)) log.debug('executing "%s"' % ' '.join(cmd))
pipe = subprocess.Popen(cmd, stdout=subprocess.PIPE) pipe = subprocess.Popen(cmd, env=env, stdout=subprocess.PIPE)
stdout, _ = pipe.communicate() stdout, _ = pipe.communicate()
if pipe.returncode != 0: if pipe.returncode != 0:
raise CommandError('openssl exited with status %d' % ( raise CommandError('openssl exited with status %d' % (
...@@ -20,7 +23,8 @@ def run(*args): ...@@ -20,7 +23,8 @@ def run(*args):
return stdout return stdout
def run_with_config(config_file, *args): def run_with_config(caroot, config_file, *args):
cmd = args[0] cmd = args[0]
args = args[1:] args = args[1:]
return run(cmd, '-config', config_file, '-batch', *args) caroot = os.path.abspath(caroot)
return run(cmd, '-config', config_file, '-batch', *args, CAROOT=caroot)
RANDFILE = %(basedir)s/.random RANDFILE = ${ENV::CAROOT}/.random
[ ca ] [ ca ]
default_ca = CA_default default_ca = CA_default
[ CA_default ] [ CA_default ]
dir = %(basedir)s dir = ${ENV::CAROOT}
certs = $dir/public/certs certs = $dir/public/certs
crl_dir = $dir/public/crl crl_dir = $dir/public/crl
crl = $dir/public/crl.pem crl = $dir/public/crl.pem
......
...@@ -27,7 +27,7 @@ class OpensslWrapTest(unittest.TestCase): ...@@ -27,7 +27,7 @@ class OpensslWrapTest(unittest.TestCase):
def test_run(self): def test_run(self):
self.mox.StubOutWithMock(subprocess, 'Popen', use_mock_anything=True) self.mox.StubOutWithMock(subprocess, 'Popen', use_mock_anything=True)
pipe_stub = PopenStub(stdout='output') pipe_stub = PopenStub(stdout='output')
subprocess.Popen(['openssl', 'test'], stdout=subprocess.PIPE subprocess.Popen(['openssl', 'test'], stdout=subprocess.PIPE, env=mox.IsA(dict)
).AndReturn(pipe_stub) ).AndReturn(pipe_stub)
self.mox.ReplayAll() self.mox.ReplayAll()
result = openssl_wrap.run('test') result = openssl_wrap.run('test')
...@@ -36,7 +36,7 @@ class OpensslWrapTest(unittest.TestCase): ...@@ -36,7 +36,7 @@ class OpensslWrapTest(unittest.TestCase):
def test_run_fails(self): def test_run_fails(self):
self.mox.StubOutWithMock(subprocess, 'Popen', use_mock_anything=True) self.mox.StubOutWithMock(subprocess, 'Popen', use_mock_anything=True)
pipe_stub = PopenStub(returncode=1) pipe_stub = PopenStub(returncode=1)
subprocess.Popen(['openssl', 'test'], stdout=subprocess.PIPE subprocess.Popen(['openssl', 'test'], stdout=subprocess.PIPE, env=mox.IsA(dict)
).AndReturn(pipe_stub) ).AndReturn(pipe_stub)
self.mox.ReplayAll() self.mox.ReplayAll()
def r(): def r():
...@@ -47,9 +47,9 @@ class OpensslWrapTest(unittest.TestCase): ...@@ -47,9 +47,9 @@ class OpensslWrapTest(unittest.TestCase):
self.mox.StubOutWithMock(subprocess, 'Popen', use_mock_anything=True) self.mox.StubOutWithMock(subprocess, 'Popen', use_mock_anything=True)
pipe_stub = PopenStub(stdout='output') pipe_stub = PopenStub(stdout='output')
subprocess.Popen(['openssl', 'test', '-config', 'conf', '-batch', 'arg'], subprocess.Popen(['openssl', 'test', '-config', 'conf', '-batch', 'arg'],
stdout=subprocess.PIPE).AndReturn(pipe_stub) stdout=subprocess.PIPE, env=mox.IsA(dict)).AndReturn(pipe_stub)
self.mox.ReplayAll() self.mox.ReplayAll()
result = openssl_wrap.run_with_config('conf', 'test', 'arg') result = openssl_wrap.run_with_config('.', 'conf', 'test', 'arg')
if __name__ == '__main__': if __name__ == '__main__':
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment